Root + Impact

Description

• Each MemorabiliaCollection struct contains a isActive field indicating whether redemption is currently enabled for this collection.

• By observeing the contract code (e.g., see where does keyword isActive appear), we can find that while this field is set during creation, the current implementation lacks a mechanism to update it once initialized.

Risk

Likelihood:

• Once a collection is created and initialized as inactive, it becomes irredeemable and effectively dead

Impact:

• User Confusion and Trust Erosion: Users may perceive the system as unreliable if seemingly valid collections are non-functional, damaging platform trust

Proof of Concept

Simply run the existing test test_RedeemMemorabilia_CollectionNotActive()

Recommended Mitigation

• Add a function only callable by organizer to set collection's status, for example:

  fucntion activateCollection(uint256 collectionId, bool isactive) external onlyOrganizer {

  require(collections[collectionId].priceInBeat > 0, "Collection does not exist");

  collections[collectionId].isActive = isactive;

  }

• Introduce a time-based mechanism that automatically updated the collection’s status based on its configured activation timestamp.